dhcpd with selinux-policy-targeted-1.17.30-3.9 in FC3

[Alex Charrett]

Hi All,

Ever since I've upgraded to selinux-policy-targeted-1.17.30-3.9 in FC3,
selinux seems to be preventing me starting dhcpd:

audit(1119637866.872:0): avc:  denied  { name_bind } for  pid=3842
exe=/usr/sbin/dhcpd src=67 scontext=root:system_r:dhcpd_t
tcontext=system_u:object_r:reserved_port_t tclass=udp_socket

Running audit2allow over this gives me the follwing:

allow dhcpd_t reserved_port_t:udp_socket name_bind;

But I can't work out what configuration file to put this in, any pointers
would be much appreciated.

Is there any reason updating the policy should prevent dhcpd from running,
was that the intention?  It certainly would seem like a funny thing do to 
do me.

Cheers,
Alex.

[Ivan Gyurdiev]

>  audit(1119637866.872:0): avc:  denied  { name_bind } for  pid=3842
>  exe=/usr/sbin/dhcpd src=67 scontext=root:system_r:dhcpd_t
>  tcontext=system_u:object_r:reserved_port_t tclass=udp_socket 
This was fixed in rawhide strict, and possibly targeted, 
but I guess the fix hasn't been pushed to updates.

-- 
Ivan Gyurdiev <ivg2(a)cornell.edu&gt;
Cornell University

[Alex Charrett]

On Fri, 24 Jun 2005, Ivan Gyurdiev wrote:

> > audit(1119637866.872:0): avc:  denied  { name_bind } for 
> pid=3842
> > exe=/usr/sbin/dhcpd src=67 scontext=root:system_r:dhcpd_t
> > tcontext=system_u:object_r:reserved_port_t tclass=udp_socket
>
>  This was fixed in rawhide strict, and possibly targeted,
>  but I guess the fix hasn't been pushed to updates. 
Hi,

This morning I've updated to the newly released 
selinux-policy-targeted-1.17.30-3.13.   This seems to have resolved the 
above error, but now I'm getting denied acess to the leases file:

audit(1119870654.402:0): avc:  denied  { read } for  pid=3242 
exe=/usr/sbin/dhcpd name=dhcpd.leases dev=md1 ino=476194 
scontext=root:system_r:dhcpd_t tcontext=system_u:object_r:file_t 
tclass=file

The line refering to dhcp.leases in
/etc/selinux/targeted/contexts/files/file_contexts looks like it should 
work ok:
/var/lib/dhcp(3)?/dhcpd\.leases.* -- system_u:object_r:dhcpd_state_t

Any more ideas?

Cheers,
Alex.

[Ivan Gyurdiev]

>  The line refering to dhcp.leases in
>  /etc/selinux/targeted/contexts/files/file_contexts looks like it should 
>  work ok:
>  /var/lib/dhcp(3)?/dhcpd\.leases.* -- system_u:object_r:dhcpd_state_t 
You can run matchpathcon <file> or restorecon <file> to find out
if this is a labeling problem or not..

matchpathcon will show you if the regexp is working, and restorecon
will actually change it to context that matches the regexp.

Strangely, on my machine the entire folder is labeled dhcp_state_t,
with no dhcpd_state_t... (but this is strict policy rawhide).

-- 
Ivan Gyurdiev <ivg2(a)cornell.edu&gt;
Cornell University